CCSP Cloud Security Operations Practice Question
A security engineer needs to scan all container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. The scan must be automated whenever a new image is pushed. Which solution meets this requirement?
⚠ Common exam trap
Many candidates mistakenly think that any security service (like Macie or Security Hub) can perform vulnerability scanning, when in fact only Inspector has the native capability to scan ECR images continuously and automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Amazon Inspector continuous scanning for ECR repositories.
Amazon Inspector continuous scanning for Amazon ECR automatically scans container images for software vulnerabilities whenever a new image is pushed to the repository. This feature is natively integrated with ECR, requires no additional infrastructure, and provides findings directly in the Inspector console and via AWS Security Hub. Option D is correct because it is the only AWS-native, automated, and fully managed solution that meets the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon Macie for image scanning.
Why it's wrong here
Macie discovers and classifies sensitive data in S3 objects; it has no container-image layer analysis and cannot subscribe to ECR push events. It tempts because Macie is AWS's managed security-scanning service, and would be correct for finding personally identifiable information stored in S3 buckets.
- ✗
Configure AWS Security Hub to scan images.
Why it's wrong here
Security Hub aggregates and normalises findings from other services; it performs no image scanning itself and cannot generate vulnerability results from an ECR push. It tempts as a central security dashboard, and would be correct for consolidating findings that Amazon Inspector's ECR scanning already produced.
- ✗
Use AWS Lambda to invoke Clair on each push.
Why it's wrong here
Clair is a standalone scanner requiring you to build, host and orchestrate the pipeline yourself; Lambda alone cannot trigger ECR's native scan-on-push. It tempts because Clair genuinely scans images, and would suit a self-managed registry outside AWS where no integrated scanning exists.
- ✓
Enable Amazon Inspector continuous scanning for ECR repositories.
Why this is correct
Amazon Inspector's continuous scanning integrates natively with Amazon ECR, automatically re-evaluating repositories when new images are pushed, which satisfies the automation constraint without custom orchestration. Unlike basic ECR scan-on-push, Inspector provides ongoing vulnerability assessment across the repository, detecting newly disclosed CVEs in existing images as well as fresh pushes.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.